Performance is a continual concern for the vendors of real-time security products, such as real-time file-scanning solutions. Traditional real-time file-scanning solutions typically: 1) detect when a file has been opened or modified and then 2) determine, by scanning the file in question, whether the file has been compromised. While a single file scan may not overly tax the resources of a computing system, the number of file operations performed by modern-day operation systems may necessitate an inordinate number of file scans, which may in turn lead to visibly slower computing-system performance and user frustration.
Although some security vendors have attempted to limit the performance impact of real-time file-scanning solutions by skipping the scanning of files based on a file's extension or based on whether a file is opened or closed, such conventional approaches are limited in effectiveness and reliability. For example, such approaches may fail to identify malicious files that have file extensions that appear to be legitimate. Similarly, such approaches may devote computing resources to scanning a modified file, even if there is a high likelihood that the modified file was not compromised. As such, the instant disclosure identifies a need for improving both the performance and reliability of traditional real-lime file-scanning security solutions.